Title
#macos
sundsta

sundsta

07/22/2019, 5:15 PM
Other, non-events queries work fine
zwass

zwass

07/22/2019, 5:16 PM
Which events tables are you accessing?
5:16 PM
Is this the live query interface, or scheduled queries?
sundsta

sundsta

07/22/2019, 5:17 PM
I tried
SELECT * FROM file_events LIMIT 10
and
SELECT * FROM process_events LIMIT 10
5:17 PM
Distributed queries, in the UI
zwass

zwass

07/22/2019, 5:18 PM
file_events
requires that you configure the watch paths. Did you do that?
sundsta

sundsta

07/22/2019, 5:22 PM
I have not... I'll look into that. Still, I believe process_events should work without any additional config
zwass

zwass

07/22/2019, 5:26 PM
I believe the
process_events
needs additional configuration (outside of osquery) as well. See https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#macos-process-auditing
5:26 PM
Some that do not need additional config are
disk_events
(try opening a dmg) or
hardware_events
(plug any usb device)
sundsta

sundsta

07/22/2019, 5:27 PM
I had not seen that page, thank you
5:52 PM
Still no luck on
process_events
, even after modifying the audit config and a reboot
5:54 PM
Now testing with
osqueryi
if that matters at all
zwass

zwass

07/23/2019, 4:25 PM
For any of those event types? What does your config look like?